One result of advances in information technology (IT) is the emergence an on-demand, pay-as-you-go utility model for software development and deployment. According to this model, applications and other IT resources are provided to customers by a service provider through a data communications network, especially the Internet. A particular model is the software-as-a-service (SaaS) model of software deployment whereby an application is hosted as a service that is provided to customers over the Internet. Among the advantages of the model is that it obviates the need to install and run the application on a customer's own computer and mitigates customer difficulties pertaining to software maintenance. SaaS also can reduce the customer's up-front costs of software purchases, through less costly, on-demand pricing. For a vendor, SaaS can be a mechanism for protecting the vendor's intellectual property and can generate an on-going revenue stream. A SaaS vendor may host the application on its own web server, or provide the application through a third-party application service provider (ASP).
Under such a utility model, because data is exchanged over a network, security is an important consideration. Network resources thus typically must maintain security policy rules which control actions for traffic between the network resources. These rules typically establish conditions that include a local Internet Protocol (IP) address and port as well as a remote IP address and port. Examples of such security policy rules are those used for IP packet filtering, by the IPsec (IP security) suite of protocols for securing IP communications by authenticating and/or encrypting each IP packet in a data stream, and by the IBM z/OS Application Transparent Transport Layer Security (AT-TLS).
As new network resources are provisioned and added to a service landscape instance, policy rules in the newly-provisioned network resource must be created so as to permit communication between the newly-provisioned network resource and eligible, remotely-located network resources. Additionally, when a network resource is provisioned, other resources in the service landscape instance must be updated to allow communication between the newly-provisioned network resource and pre-existing network resources. Enabling security for an IT infrastructure, such as configuring system firewalls and intrusion defenses, however, typically involves considerable manual configuration effort and generally requires platform-specific expertise. The process, if performed manually, can be time-consuming, error-prone, and potentially disruptive. Enabling security to protect networked systems that form the service landscape instance, however, is likely to be a key factor in the acceptance and deployment of new on-demand services.